| शीर्षक | AlejandroArciniegas mcp-data-vis 1.0.0 SQL Injection |
|---|
| विवरण | AlejandroArciniegas mcp-data-vis contains an SQL injection vulnerability in src/servers/database/server.js. The create_table tool constructs a CREATE TABLE statement by embedding an attacker-controlled schema value directly into SQL text and executes it with db.exec() without parameterization or strict validation. An attacker who can invoke the vulnerable MCP handler can execute unintended SQL statements against the application's SQLite database, which may result in unauthorized data access, modification, or deletion. |
|---|
| स्रोत | ⚠️ https://github.com/wing3e/public_exp/issues/19 |
|---|
| उपयोगकर्ता | BigW (UID 96422) |
|---|
| सबमिशन | 16/03/2026 10:23 AM (7 महीनों पहले) |
|---|
| संयम | 01/04/2026 03:03 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 354654 [AlejandroArciniegas mcp-data-vis MCP server.js request SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|